The October 2026 PHP flaw: what it means for your website
Short answer: if your website runs on WordPress or anything else built with PHP, your host needs to have updated PHP since 21 October 2026. Updating WordPress itself doesn't fix it. If your site is on PHP 8.1 or older, it needs upgrading.
What happened
On 21 October 2026, PHP released fixes for two critical security flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 and can let an attacker run code on a web server without logging in.
The flaws are in PHP itself, the language WordPress and many other websites run on. So it doesn't matter how carefully a site's plugins were kept up to date: if the server's PHP was vulnerable, the site was too.
Working attacks appeared quickly. Reports say attacks began around six hours before the patch was published, and attempts were in the millions within a day.
What to check today
- Ask your host whether PHP has been updated. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer.
- Check your PHP version. If it's 8.1 or older, it no longer gets regular security fixes. Plan an upgrade now.
- Don't rely on a WordPress update. WordPress has said no WordPress release is needed; the fix is entirely on the PHP side.
- Look for signs of compromise if your site was unpatched for any time after 21 October: unknown admin users, unfamiliar files, strange redirects, or warnings in Google Search Console. If you find any, see what to do if your website is hacked.
For hosts and developers: turning off session.upload_progress.enabled blocks one attack path for CVE-2026-109619, but PHP is clear it isn't a full fix. Patch.
The bigger lesson
Every website that runs code on a server has to be patched, forever, usually by someone else, and often at short notice. Most small business websites don't need any of that. A brochure site with a few pages and a contact form can be built as a static site and served from a global network like Cloudflare's, with no PHP, no database and no server to patch.
The sites I build that way had nothing to do on 21 October. That's not a sales trick; it's just less to go wrong. Static sites still need care (your domain account, DNS and email matter), and online shops or members' areas still need a server. But for many businesses, the safest server is no server.
If you'd like to know whether your site could work that way, get in touch. Or see how I build small business websites.